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Abstract 


Loss of Crew (LOC) and Loss of Mission (LOM) are two key requirements the 
Constellation Program (CxP) measure against. To date, one of the top risk drivers for 
both LOC and LOM has been Orion’s Crew Exploration Vehicle (CEV) Parachute 
Assembly System (CPAS). Even though the Orion CPAS is one of the top risk drivers of 
CxP, it has been very difficult to obtain any relevant data to accurately quantify the risk. 

At first glance, it would seem that a parachute system would be very reliable given the 
track record of Apollo and Soyuz. Given the success of those two programs, the amount 
of data is considered to be statistically insignificant. However, due to CxP having 
LOC/LOM as key design requirements, it was necessary for Orion to generate a valid 
prior to begin the Risk Informed Design process. To do so, the Safety & Mission 
Assurance (S&MA) Space Shuttle & Exploration Analysis Section generated an initial 
failure probability for Orion to use in preparation for the Orion Systems Requirements 
Review (SRR). 
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Introduction to NASA’s Constellation Program (CxP) 


The Constellation program has been established to: 

- Develop a safe, affordable, reliable and sustainable system to conduct human 
exploration across the solar system 

- Develop an exploration system that will support an extended human mission to 
the surface of the Moon no later than 2020 

- Develop the capability for a sustainable and extensible permanent human 
presence on the Moon for commercial, national pre-eminence and scientific 
purposes leading to future exploration of Mars and beyond 

- Establish a capability to conduct human expeditions to Mars and beyond. 

The CxP Office is developing, integrating, and evolving an architecture to accomplish 
these needs and goals. The Cx Architecture is currently comprised of spacecraft, launch 
vehicles, support systems, and destination systems to further these space exploration 
goals. The Cx Architecture also has several key external interfaces that are critical to the 
success of Cx missions. Figure 1 illustrates which Cx elements are utilized for the ISS 
and Lunar missions. 1 


1 Constellation Program Overview, October, 2006, John F. Connolly, Constellation Program Office, 
National Aeronautics & Space Administration (NASA) 




Figure 1: Components of the Constellation Program (CxP) 


2 Constellation Program (CxP) Missions 

The CxP missions fall into three general categories: missions to the International Space 
Station (ISS), missions to the Moon, and missions to Mars. The ISS missions consist of 
ISS crew rotation missions. The Lunar missions demonstrate the capability of the 
architecture to transport and land humans on the Moon, operate for a limited period on 
the surface, and safely return them to Earth. Lunar missions also allow for exploration of 
high-interest science sites or scouting of future Lunar Outpost locations. The Mars 
missions will demonstrate the capability of the architecture to transport and land humans 
on Mars, operate for a limited period on the surface, and safely return them to Earth . 2 

3 Applicable Design Reference Missions (DRMs) 

The following sections briefly describe each of the applicable CxP DRMs that were 
planned as of the beginning of the program. There are three major DRMs: the ISS 
Crewed DRM, the Lunar DRMs, and the Mars DRM. The Lunar DRMs contain three 
variations: the Lunar Sortie DRM, the Lunar Outpost DRM, and the Lunar Cargo DRM. 
Of these three DRMs, the Lunar Cargo DRM would not utilize the Orion spacecraft. 


2 Constellation Program Overview, October, 2006, John F. Connolly, Constellation Program Office, 
National Aeronautics & Space Administration (NASA) 




Thus, the Lunar Cargo DRM would not be applicable in terms of having the Orion CPAS 
operate. 

3. 1 Lunar Design Reference Missions 
3.1.1 Lunar Sortie Crew DRM 

Lunar Sortie missions are representative of missions that enable up to four crewmembers 
to explore a single site anywhere on the Moon with the length of stay limited by the 
amount of consumables brought by Altair, the Lunar Lander, and Delta-V margins. This 
type of mission is accomplished independent of pre-positioned lunar surface 
infrastructure such as habitats or power stations. A Lunar Sortie mission may occur at 
any time during the CxP Lunar Campaign. The Lunar Sortie mission allows for 
exploration of high-interest science sites, scouting of future Lunar Outpost locations, or 
other technology development objectives within the capabilities of the available lunar 
surface infrastructure. During a sortie, the crew has the capability to perform daily 
Extravehicular Activities (EVAs). 

A Lunar Sortie mission utilizes the following elements for a mission: Ares I, Orion, Ares 
V, Lander, Mission Systems (MS), Ground Systems (GS), EVA and Portable Equipment. 
The ascent mission mode for the Lunar Sortie mission is a combination Earth 
Rendezvous Orbit and Lunar Rendezvous Orbit (ERO-LRO) architecture. The 
Altair/Earth Departure Stage (EDS) is inserted into ERO with a single Ares V launch 
followed within 90 minutes by an Ares I launch of the crew and cargo aboard the Orion. 
Orion and Altair/EDS then rendezvous and dock in ERO. The crew may enter Altair prior 
to Trans-Lunar Injection/Lunar Orbit Insertion (TLI/LOI). The EDS performs the TLI 
bum for Altair and Orion and then separates from the stack. The EDS maneuvers to target 
for a safe disposal away from the Orion/ Altair path or any future spacecraft missions. 
Altair performs any required mid-course correction maneuvers during the trans-lunar 
cruise. Upon reaching the Moon, Altair then performs the LOI for the two mated 
elements. Figure 2 illustrates the Lunar Sortie Crew mission. Although this DRM 
represents the current baseline Lunar Sortie mission, the architecture developed to 
support this DRM should not preclude the capability to accomplish a Lunar Sortie with a 
single launch of both crew and cargo on the Ares V/' 


J Constellation Program. (March 21, 2010). In Wikipedia. Retrieved March 30, 2010 from 
http://en.vvikipedia.Org/wiki/C onstellation program#Missions 
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Figure 2: Lunar Sortie Crew DRM 


3.1.2 Visiting Lunar Outpost Expedition DRM 

The Visiting Lunar Outpost Expedition DRM is representative of a mission with a crew 
size up to four, where the crew is dependent on the resources from Altair to survive for 
the duration of the mission; however, as available, some resources from Lunar Surface 
Systems (LSS) may be used to extend the length of the surface stay. This mission is 
intended to perform tasks at a Lunar Outpost site that utilize a human’s expertise, 
dexterity, realtime evaluation and ability to improvise. These missions would conceivably 
be used to construct a Lunar Outpost, or provide needed logistics or repairs to an existing 
Outpost. 

Crew size is determined by the surface operations that are required to accomplish mission 
objectives. If the crew consists of fewer than four crewmembers, the mass saved may be 
replaced by additional equipment or small cargo needed for the surface mission. The 
delivery of cargo on the same vehicle as the crew provides flexibility and optimization to 
the Outpost construction schedule. These missions incrementally build upon useful 
infrastructure left behind after the completion of previous missions. The duration of crew 
surface time for this DRM will vary depending on the Outpost construction and 
payload/technology objectives. 

A Visiting Lunar Outpost Expedition mission utilizes the following systems for a 
mission: Ares I, Orion, Ares V, Lander, MS, GS, EVA, LSS and Portable Equipment. 



The ascent mission mode for the Lunar Outpost Crew mission, just like the Lunar Sortie 
mission, is a combination ERO-LRO architecture. Altair is pre-deployed with a single 
Ares V launch to ERO followed within 90 minutes by an Ares I launch of the crew and 
cargo aboard the Orion. Orion and Altair/EDS then rendezvous and dock in ERO. Figure 
4, Lunar Outpost DRM, illustrates the Lunar Outpost Crew mission. Robotic systems 
perfonn the function of off-loading crew task overhead and performing activities that 
would otherwise impact the productivity or safety of the crew. 4 
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Figure 3: Lunar Outpost - Crew DRM 


3.2 ISS Design Reference Missions 

The ISS DRM supports ISS increment crew rotation and re-supply of the ISS. ISS 
missions provide a proving ground for Constellations systems while at the same time 
providing an alternate resource for the support of ISS crewed operations. The presence of 
a quiescent Orion at the ISS should be included and that the existing ISS crew returns to 
Earth in the Orion that brought them to the ISS, not in the Orion that brings the 
replacement crew. 


4 Constellation Program. (March 21, 2010). In Wikipedia. Retrieved March 30, 2010 from 
http://en.vvikipedia.Org/wiki/C onstellation program#Missions 


An ISS mission utilizes the following systems for a mission: Ares I, Orion, MS, GS, and 
Portable Equipment. After separating from the Ares I, Orion performs orbit raising bums 
per a pre-mission-defined rendezvous phasing profile, modified as necessary to account 
for actual trajectory conditions, to close in on the ISS. These will be a combination of 
ground-targeted and onboard-targeted bums, the latter performed once rendezvous 
navigation sensors acquire the ISS. Any EVA contingency operations originate from the 
ISS, using ISS resources. The ISS mission involves the launch of Ares I into a 51.6 
degree inclination orbit with a crew of three to six destined for a 6-month ISS expedition. 
Figure 5 illustrates the ISS mission/ 



Figure 4: ISSDRM 


3.3 Mars DRM 

The Mars Design Reference Mission employs conjunction-class missions, often referred 
to as long-stay missions, to minimize the exposure of the crew to the deep-space radiation 
and zero-gravity environment while at the same time maximizing the scientific return 
from the mission. This is accomplished by taking advantage of optimum alignment of the 
Earth and Mars for both the outbound and return trajectories by varying the stay time on 
Mars, rather than forcing the mission through non-optimal trajectories as in the case of 


5 Constellation Program. (March 21, 2010). In Wikipedia. Retrieved March 30, 2010 from 
http://en.vvikipedia.Org/wiki/C onstellation program#Missions 


the short-stay missions. This approach allows the crew to transfer to and from Mars on 
relatively fast trajectories, on the order of six months, while allowing them to stay on the 
surface of Mars for a majority of the mission, on the order of 18 months. The working 
assumption for crew size is six, based on previous analysis. The surface exploration 
capability is implemented through a split mission concept in which cargo is transported in 
manageable units to the surface, or Mars orbit, and checked out in advance of committing 
the crews to their mission. The split mission approach also allows the crew to be 
transported on faster, more energetic trajectories, minimizing their exposure to the deep- 
space environment, while the vast majority of the material sent to Mars is sent on 
minimum energy trajectories. Emphasis is placed on ensuring that the space 
transportation systems are designed to be flown in any Mars injection opportunity. This is 
vital in order to minimize the programmatic risks associated with funding profiles, 
technology development, and system design and verification programs. 5 


4 Element Overviews 

4.1 Orion 

The Orion System consists of a Crew Module (CM), a Service Module (SM), a Launch 
Abort System (LAS), and a Spacecraft Adapter (SA), and transports crew and cargo to 
orbit and back. The Orion System will be used in all phases of the CxP. Initially, the 
Orion transports crew to and from the ISS. It will subsequently transport crew and cargo 
to and from a lunar orbit for short and extended duration missions. Linally, the Orion or a 
derivative will support missions to a Mars Transfer Vehicle, and then return the crew and 
cargo to Earth after separation from the vehicle. There may be unique configurations to 
accommodate the needs of each defined DRM. 

Orion is the spacecraft used to transfer flight crews, cargo, and support equipment from 
Earth to Low Earth Orbit (LEO) or lunar orbit, and subsequently return the crew to 
Earth’s surface. For a lunar mission, the Orion must first rendezvous with the Earth 
Departure Stage (EDS)/Altair which will be loitering in LEO. For the trans-lunar portion 
of the mission the Trans-Lunar Injection (TLI) bum will be performed by the EDS. 
Subsequent course correction maneuvers will be performed by Altair. In conjunction with 
Altair and EDS, the Orion delivers the flight crew to Low Lunar Orbit (LLO) and 
subsequently loiters there without crew onboard while the lunar surface expedition is 
performed. After returning to orbit with Altair, the crew transfers back to the Orion, and 
the Orion returns the crew to Earth. 

The Orion is comprised of four distinct modules: a Launch Abort System (LAS), a Crew 
Module (CM), a Service Module (SM), and a Spacecraft Adapter (SA). These modules 
are seen from left to right in Figure 7. 6 


6 Constellation Program and Project Overview. Kemieth S. Reightler, Vice President, NASA Program 
Integration. Lockheed Martin Space Systems Company. November 6, 2007. Retrieved March 30, 2010 
from www.califomiaspaceauthoritv.org/. ../071 106-1300-Reightler.pdf 
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Figure 5: Expanded Orion Layout 7 


5 Overview of the Orion CEV Parachute Assembly System (CPAS) 

Prior to the Orion SRR, the Orion CPAS was comprised of three major components: the 
Forward Bay Cover (FBC), two Drogue parachutes, and three Main parachutes. All 
components of the Orion CPAS are located in the Forward Bay of the Crew Module 
(CM). 

The purpose of the FBC is to protect the entire Landing & Recovery System (LRS) 
components through all phases of the mission. Prior to deployment of the Drogue 
parachutes, the FBC is jettisoned by deploying two Pilot parachutes. Each of the FBC 
Pilot parachutes are deployed via mortars. 

Post-FBC jettison, the two Drogue parachutes were to then be deployed simultaneously 
via mortars. Each Drogue parachute possessed a single stage of reefing to help manage 
the aerodynamic loads imposed on the parachutes. After each Drogue parachute 
completed their respective reefs, they would be used to decelerate and stabilize the Orion 
Crew Module (CM). Once the CM became stable and achieved a desired dynamic 
pressure necessary for the Main parachute deployment, the two Drogue parachutes would 
then be released by pyrotechnic-initiated cutters. 

After the Drogue parachutes were released, three Pilot parachutes would simultaneously 
be deployed via mortars. After the Pilot parachutes inflate, they would independently 


7 Constellation Program and Project Overview. Kenneth S. Reightler, Vice President, NASA Program 
Integration. Lockheed Martin Space Systems Company. November 6, 2007. Retrieved March 30, 2010 
from www.califomiaspaceauthoritv.org/. ../071 106-1300-Reightler.pdf 


extract each of the Main parachutes from the CM Forward Bay. As with the Drogue 
parachutes, the Main parachutes were also reefed to help manage the loads. However, 
the lone difference between the two was that the Main parachutes had two reefing stages 
as opposed to one for the Drogue parachutes. When the Main parachutes attained full 
inflation, they would remain attached to the CM until landing either on water or land. 
Once the CM lands, the three Main parachutes would then be released via pyrotechnic- 

o 

initiated cutters. 
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Figure 6: Notional LRS Sequence of Events 8 9 


6 Development of the Orion CPAS Main Parachute Failure Probability 

As part of the Orion Risk Informed Design (RID) process, LOC/LOM probabilities were 
a key figure of merit used to determine how much system redundancy to place on the 
vehicle. With human-rated spacecraft, the majority of the systems tend to be similar. 
Thus, the data used to generate the Orion LOC/LOM probabilities were primarily 
heritage based numbers from the Space Shuttle Program (SSP) and the International 
Space Station (ISS) program. Given that Lockheed Martin did not have many of the 


8 Constellation Program. (March 21, 2010). In Wikipedia. Retrieved March 30, 2010 from 
http ://en. wikipedia.org/wiki/Constellation program#Missions 

9 http://www.nasa.gov/images/content/156596main Orion Sequence 500.jpg 


Orion spacecraft vendors under contract at the beginning of the RID process, the project 
agreed to use SSP and ISS heritage based data. 


This worked well for many of the Orion system and subsystem trades. However, there 
were some systems/subsystems that Orion had in their current design that SSP, ISS, or 
both did not utilize. One of the more obvious subsystem differences was that of the 
Landing & Recovery System (LRS). Obviously, the ISS does not have a LRS since it is 
a permanent fixture in Low Earth Orbit (LEO). Since the Orbiter is considered to be a 
reusable spacecraft, it must have the capability to return to Earth and therefore has a LRS. 
However, the main difference between the Orbiter and Orion is how each spacecraft 
lands. 

The Orbiter lands very similarly as to how an airplane does. After the Orbiter re-enters 
the atmosphere, it basically utilizes its two wings and elevons to glide down to the 
Primary Landing Site (PLS) runway. Once the Orbiter approaches the PLS, the landing 
gear is deployed. After touchdown, a Drag Parachute is deployed from the aft part of the 
Orbiter to help decrease its speed after touchdown. Orion’s basic design does not include 
any type of wings as it is a capsule. Thus, Orion has no capability to guide the vehicle to 
a specific landing site after entry. Once Orion has re-entered the Earth’s atmosphere and 
achieved a certain speed and dynamic pressure, parachutes are used to slow Orion to a 
safe velocity for landing. Due to the large differences in the Orbiter and Orion landing 
systems, Orion Safety & Mission Assurance (S&MA) Analysis Section personnel were 
asked to help develop an initial failure probability for the Orion CPAS Main Parachute. 
The following sections detail the data used in developing the CPAS main parachute 
failure probability. 

6.1 NASA’s Smart Buyer Parachute Failure Probability Estimate 

In January, 2006, the Crew Exploration Vehicle (CEV) Smart Buyer Design effort was 
chartered to develop an in-house design of the CEV. The in-house design was used by 
the CEV Project to assess driving requirements and alternatives. To accomplish this task, 
an Agency-wide team was assembled with representatives from all ten NASA Centers 
and from NASA Headquarters. Due to the short duration of the design effort, the Smart 
Buyer Team (SBT) concentrated on a limited number of trade study areas. Included as 
one of the selected trade areas, was the Landing and Recovery System (LRS). As part of 
the Smart Buyer Design effort, trade studies were conducted on the reliability of the LRS. 
As a result of the SBD effort, a failure probability for the CEV main parachutes was 
developed. The resultant failure probability was used by NASA to help generate 
requirements for the following year. 10 Actual data and results of the SBT parachute 
failure probability are not included in this paper due to Export Control policy at NASA. 


6.2 CxP Main Parachute Failure Probability Estimate 


10 NASA Engineering & Safety Center (NESC) Supporting the Constellation Program. NESC Update: 
Volume 4. August 2006. 



In 2007, after the Smart Buyer Design effort ended, the CxP began to develop 
preliminary LOC/LOM estimates for the Lunar Sortie and ISS Crewed Design Reference 
Missions (DRMs). In both DRMs, the Orion spacecraft is utilized which implies the 
CPAS must operate in order to complete either DRM successfully. In these preliminary 
stages of evaluating LOC/LOM, analysis personnel adopted the parachute failure 
probability that was developed by the SBT. This was due in large part to limited 
resources and a very demanding schedule. However, after consulting with CPAS 
engineering personnel and Orion LRS personnel, it was decided that the SBT parachute 
failure probability was not very representative of the Orion CPAS main parachutes. 

Thus, it was collectively agreed to that NASA S&MA Analysis Section personnel would 
develop a new failure probability for the Orion CPAS main parachutes. 

Instead of using Jeffrey’s Non-Informative Prior, CxP Analysis personnel chose to 
develop the main parachute prior based on Apollo, Soyuz, and Military data. This was 
due to the fact that the majority of the data had been recorded in roughly the same time 
period. Once the prior was established in the form of a Beta distribution, it would then be 
Bayesian updated with the more recent Space Shuttle SRB parachute data using the Beta- 
Binomial conjugate pair. The following sections detail the data used in that process. 

6.2.1 Apollo Parachute History 

During the Apollo Program, there were a total of fifteen launches. Eleven of those 
launches were for a lunar mission and four launches for non-lunar missions. The four 
non-lunar missions included three to Skylab and one for the Apollo-Soyuz Test Program 
(ASTP). Each of the fifteen Apollo missions used three main parachutes. This resulted 
in a total of forty- five demands (15 missions x 3 main parachutes per mission). Out of 
those fifteen Apollo missions and forty-five demands, there was only one documented 
parachute failure. That failure occurred during the descent portion of the Apollo 15 
mission. 1 1 

During the descent portion of the Apollo 15 mission, the three main parachutes had 
operated properly starting at 3,050 meters and had fully reefed. At approximately 1,825 
meters, one of the three main parachute canopies collapsed. This left the Apollo 15 
Command Module (CM) with two functioning parachutes. Fortunately, the CM was able 
to safely land with two of the three main parachutes functioning. The lone parachute 
canopy that collapsed was never recovered so the exact cause of failure is not exactly 
known. However, after inspecting one of the two main parachutes that functioned, it was 
discovered the Reaction Control System (RCS) may be to blame. 


11 Apollo Lunar Surface Journal, Mission Report, Part 6. http : //history. nasa . go v/alsi /frame . html 



Figure 7: Apollo 15 Main Parachute Failure 

Once other possible failure modes were ruled out, it was concluded that RCS fuel was 
dumped after the main parachutes were fully inflated. A portion of the RCS fuel dump 
was ignited as it was being expelled and made contact with some of the main parachute 
riser and suspension lines. This resulted in the riser and suspension lines melting causing 
the canopy collapse. This failure did not occur to any previous Apollo flights simply 
because of the main parachute locations during the RCS fuel expulsion. Apollo 15 just 
happened to have one of the three main parachutes located directly above the RCS 
engines during this exercise. As a result of the findings, NASA made both material and 
procedural changes to avoid any potential catastrophic failures in the future. These 
known changes made to the Apollo parachute system allowed for the analysts to discount 



the failure by 90%. Instead of counting a full failure, only . 1 failures were counted 
towards the Apollo parachute data. 12 

6.2.2 Soyuz Parachute History 

Between the end of the Smart Buyer Design and CxP developing a new main parachute 
prior, Soyuz had an additional six launches. Combining these six additional launches 
with the ninety-three that the SBT considered, CxP assessed a total of ninety-nine Soyuz 
launches. Of the ninety-nine launches there was only one failure. That failure occurred 
on Soyuz 1 in 1967. 



Re-entry of Soyuz 1 was successful as was the deployment of the drogue parachute. 
However, due to a pressure sensor failure, the main parachute did not deploy. After the 
main parachute failed to deploy on its own, the cosmonaut attempted to deploy the 
reserve main parachute manually. The reserve main parachute deployed but was soon 
entangled with the drogue parachute which had not been released. Normally, the drogue 
parachute would have been released upon deployment of the main parachute. Given the 
main parachute never deployed, the drogue parachute was never released. Since the 
Soyuz 1 catastrophe, there have been no known fatal parachute events in the subsequent 
Soyuz flights. As with the Apollo parachute data, the lone Soyuz parachute failure was 
discounted. This was accomplished given the fact that there has not been a Soyuz 
parachute failure since the Soyuz 1 incident. However, unlike Apollo, the Soyuz failure 
was only discounted by 50% due to the lack of insight as to how the Russians were able 


12 Arabian, Donald D. and Joseph E. Mechelay, “Apollo 15 Main Parachute Failure.” 7 lh Aerospace 
Mechanical Symposium . Houston, TX: NASA Lyndon B. Johnson Space Center, 1972. P 137-148. 

13 Soyuz 1, http://www.astronautix.com/flights/sovuzl.htm 




to fix/modify the Soyuz parachute system following the Soyuz 1 catastrophe. In this 
case, only .5 failures counted towards the Soyuz parachute failure probability. 14 


6.2.3 Military Parachute Data 

A previous NASA Engineering & Safety Center (NESC) study concerning the Crew 
Exploration Vehicle (CEV) LRS used eight years (1968-1975) of military data to help 
assess the main parachute failure of probability. The military data was based on 
unmanned supply drops and included both procedural and equipment failures. Only the 
equipment failures were considered for calculating the main parachute prior. 
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TABLE 6.14 8-YEAR SUPPLY/EQUIPMENT DROP RECORD 
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Figure 9: Generic Military Parachute Data 

Unfortunately, the state of knowledge regarding the military data is very low. For 
instance, based on the military data below, it is unclear as to how many parachutes were 
used in each drop. We also do not know if any design or material changes were 
implemented to correct any of the failures. Without this knowledge, the analysts were 
unable to discount any of the recorded equipment failures. However, this set of data does 
provide a significant number of drops unlike the Apollo, Soyuz, or SSP SRB data. 

Assuming each supply/equipment drop is equivalent to one demand, there is a total of 
ninety-six thousand nine hundred eighty-eight demands over the eight year period. 

During the eight year span, there were also a total of one hundred fifty-four equipment 
failures. The resulting parachute failure probability over the eight year period equated to 
1.6E-03. 15 


6.2.4 Space Shuttle Program (SSP) Solid Rocket Booster (SRB) Parachute History 


Every Space Shuttle launch utilizes two Solid Rocket Boosters (SRBs) during the Ascent 
portion of the mission. Each of the SRBs is equipped with a parachute system so they 

14 MIR Hardware Heritage, Part 1 . http://spaceflight.nasa.gov/history/shuttle-mir/references/r- 
documents.htm 

15 Recovery Systems Design Guide . Air Force Flight Dynamics Laboratory AFFDL-TR-78-15 1 . Wright- 
Patterson AFB, OH. Irvin Industries Inc. Gardena, CA. December 1978. 


can be recovered and refurbished for future launches. The SRB parachute system 
consists of a drogue parachute and three main parachutes. Below, Figures 10 and 1 1 
displays what a typical SRB looks like during descent and at splashdown. 



Figure 10: Typical SRB Descent 16 


16 http://gcaptain.com/maritime/blog/interesting-ship-week-nasa-recovery/ 



Figure 11: Typical SRB Splashdown 17 

At the time of this analysis. Space Shuttle launches STS-1 thru STS- 124 were considered 
as relevant data. This set of launch data did not include STS-5 1L (Challenger) due to the 
catastrophe suffered during Ascent. After discussions with SRB Reliability personnel, it 
was noted that many upgrades had been made to the SRB parachutes over the years. 
Primarily, the majority of the updates occurred prior to the Challenger accident. As a 
result the SRB main parachute failure rate has decreased over the years. To account for 
the decrease in failure rate, only the SRB main parachute data post-Challenger was 
considered. Prior to Challenger, there were a total of twenty-five Space Shuttle launches. 
Subtracting those away from the total number of launches left a total of ninety-eight 
launches to assess. To get the likelihood of a single SRB main parachute, the total 
number of failures, post-Challenger, was divided by the total number of demands. The 
total number of demands is equates to 98 missions x 2 SRBs x 3 main parachutes per 
SRB. This resulted in a total of five hundred eighty-eight demands. In order to comply 
with Export Control policy, the z = total number of SRB failures in the ninety-eight 
missions. 

With the given data, the SRB main parachute Likelihood can be calculated by dividing 
the number of failures considered, z, by the total number of demands (588). Doing so 
produced a Likelihood value of (z/588)per demand. 


7 Calculating the CPAS Main Parachute Prior & Posterior 


17 http://gcaptain.com/maritime/blog/interesting-ship-week-nasa-recoverv/ 



As mentioned above, the course of action to produce a failure probability for the CPAS 
Main parachute was to develop a prior based on discounted- Apollo, discounted-Soyuz, 
and Military data. Given the sets of data reflected demand events, the resulting prior 
distribution was a Beta with a — 0.2 and /> = 82.7. The prior data and data sources are 
summarized below in Figure 14. 


The generic data sources: 


Source 

Comments 

Failures 

Demands 

Mean 

Variance 

Soyuz 

One discounted failure 

0.5 

99 

5. IE-03 

5. IE-05 

Apollo 

One discounted failure 

0.1 

45 

2.2E-03 

4.9E-05 

AFFDL-TR-78-151 

Nine years of Army drops 

154 

96,988 

1 .6E-03 

1.6E-08 


The resulting prior: 


Distribution 

Mean 

Mean 1 

a p 

"EF” 

Beta 

2.95E-03 

339 

02 82.7 

8.1 


Figure 12: CPAS Main Parachute Prior Summary 

Now that the CPAS Main parachute prior distribution has been established as a 

82.7), the Beta-Binomial conjugate pair can be used to determine the posterior 
distribution. This is the same process as used in the SBT Bayesian update for the CEV 
Main parachute failure probability (Section 6.1). 

To re-iterate, the Beta-Binomial conjugate pair states that if the prior distribution, n a , is a 
Beta distribution with a and /? as the parameters, one can Bayesian update n 0 with 
Likelihood data in the form of a Binomial distribution where x = total number of failures 
and N = total number of trials. The resulting posterior distribution, tt ± , is in the form of a 
Beta distribution with the parameters of a + x and /? + N - x. The mean of tt 1 can be 
calculated as x = (a + x)/(a + (3 + AQ. In this case, a = 0.2, /? = 82.7, x = z, and N = 
588. 

Now with a Beta distribution as the prior, and a Binomial distribution as the Likelihood, 
the posterior distribution for the CPAS main parachute can be formed as a Beta 
distribution. The resulting posterior Beta distribution parameters would be ff' = .2 + z 
and = 82.7 + 588 - z. The resulting mean of the posterior distribution would be 
calculated as follows: 


x = [(.2 + z)/(.2 + 82.7 + 588)] 


7.1 Issues with the Results 


As the results shown above in Figure 16 were presented to the CPAS Project, several 
concerns were raised regarding the relativity of the data. Two of the four data sources 
used (Military data and SRB data) utilized parachute systems that were not human-rated. 
The Soyuz is considered a human-rated vehicle. However, the parachute system uses a 
single main parachute as opposed to a cluster of three. However, out of all the human- 
rating and configuration deltas, the largest concern was the lack of Apollo data. There 
were only a total of fifteen missions, or forty-five demands. As a result of this concern, 
an effort was launched to try and find all of the test data from the Apollo parachute 
system. Several documents were found to have Apollo parachute test data recorded. 
However, the data was recorded in such a manner, that the analysts were unable to tell 
which configuration was tested and exactly what component failed during the test. To 
date, CPAS engineering personnel are still attempting to find relevant Apollo parachute 
test data with no success thus far. 

8 Summary 

With any future, human-rated spacecraft NASA develops, finding appropriate data to 
help quantify a system/sub-system/component risk will be necessary. Unfortunately, due 
to the cost of human spaceflight and all of the associated testing, there will always be a 
shortage of useful data. As a result, NASA will continue to use surrogate data to develop 
prior distributions and initial posterior distributions. The work done to quantify the initial 
CPAS main parachute has been instrumental in educating the engineering directorates 
about Bayesian updating. Multiple lessons learned have also been taken from this 
exercise in hope of refining the techniques for quantifying other system/sub- 
system/components located on future human spaceflight vehicles. 



